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Abstract — Gabidulin codes are the rank-metric analogs of 
Reed-Solomon codes and have a major role in practical error 
control for network coding. This paper presents new encoding 
and decoding algorithms for Gabidulin codes based on low- 
complexity normal bases. In addition, a new decoding algorithm 
is proposed based on a transform-domain approach. Together, 
these represent the fastest known algorithms for encoding and 
decoding Gabidulin codes. 

I. Introduction 

Gabidulin codes [1] are optimal codes for the rank metric 
that are closely related to Reed-Solomon codes. These codes 
have attracted significant attention recently as they can provide 
a near-optimal solution to the error control problem in network 
coding [2], [3]. 

So far, two methods have been proposed for decod- 
ing Gabidulin codes: a "standard" method based on the 
Berlekamp-Massey algorithm (or the extended Euclidean algo- 
rithm) [1], [4], and a method based on a Welch-Berlekamp key 
equation [5]. The two methods are most efficient for high-rate 
and low-rate codes, respectively [6]. 

In this paper, we improve the computational complexity of 
the standard (time-domain) algorithm by the use of optimal or 
low-complexity normal bases. With this modification, the two 
most demanding steps (computing the syndromes and finding 
the root space of the error span polynomial) become quite 
easy to perform. In addition, we propose a transform-domain 
approach to the decoding, based on a novel definition of a 
Fourier-like transform for vectors in a finite extension field. 
The transform-domain approach is shown to be more suitable 
for low-rate codes, while the time-domain method is most 
suitable for high-rate codes. Drawing on the insights above, 
we also propose two new encoding algorithms, which improve 
on the complexity for either systematic high-rate codes or 
nonsystematic codes. 

The transform approach has the additional benefit of pro- 
viding new, simpler proofs of the key equations, further 
strengthening the connections with classical coding theory. 

The remainder of the paper is organized as follows. In Sec- 
tion nil we review rank-metric codes and some known results 
about normal bases. Sections InD |IV] and |V] present, respec- 
tively, our time-domain decoding algorithm, our transform- 
domain decoding algorithm, and our two encoding algorithms. 
Finally, Section[yi]presents our conclusions. Most proofs have 
been omitted due to lack of space. 

This work was supported by CAPES Foundation, Brazil. 



II. Preliminaries 
A. Linear Algebra Notations 

In this paper, all bases, vectors and matrices are indexed 
starting from 0. Let V and W be finite-dimensional vector 
spaces over a field F with ordered bases A = {ao, . . . , ctn-i} 
and B = {/3o, . . . , /3m-i}, respectively. For w e y, we 
denote by \y\j^ the coordinate vector of v relative to A; 
that is, [v]^ ^ [vo ■■■ where vo,...,Vn-i are 

the unique elements in F such that v — X^T^o^ viai. Let 
T be a linear transformation from V to W . We denote by 
\T\ . the matrix representation of T in the bases A and 

B 

B\ that is, [r]^ is the unique n x m matrix over F such 
'"^^ Pj, i = 0, . . . ,n - 1. With 

these notations, we have [T(u)] ^ — [v]^ [T] ^. Let U be 
a finite-dimensional vector space over F with ordered basis 
O = {9o, . . . ,9k^i}, and let S* be a linear transformation 
from W to U. Recall that [7] 



that na,) = ET=o{[T][ 



(1) 



B. Rank-Metric Codes 

Let qhe a power of a prime and let denote the finite field 
with q elements. Let FJ^^™ denote the set of all n x m matrices 
over ¥q, and set F^^ = F^'^^. Let F^m be an extension field 
of ¥q. Recall that every extension field can be regarded as a 



vector space over the base field. Let A= {ao, 



L}be 



a basis for F^m over ¥q. Since F^m is also a field, we may 
consider a vector v G ¥q,„ . Whenever v G F^m , we denote 

by Vi the ith entry of v; that is, v — [vq ■ ■ ■ t'n-i]^- It 
is natural to extend the map [-j^ to a bijection from F^'m to 
jpnxm^ where the ith row of [w] ^ is given by [vi\ ^. When the 
basis A is fixed, we will use the simplified notation a= [a] ^ 
for a G Fgm and v— [«] _^ for v G F^™ . 

Define the rank of a vector v G F^™, denoted by rank(u), 
to be the rank of the associated matrix u, that is, rank(w) = 
rank(w). Similarly, define the rank distance between u,v G 
¥qm to be c?r(u,w) = rank(w — u). It is well-known that the 
rank distance is indeed a metric on FJ^\„ [1]. 

A rank-metric code C C F^™ is a block code of length n 
over ¥qm that is well-suited to the rank metric. We use ^^(C) 
to denote the minimum rank distance of C. 

For TO > n, an important class of rank-metric codes was 
proposed by Gabidulin [1]. Let [i] denote g*. A Gabidulin 
code is a linear (n, k) block code over F^m defined by the 



parity-check matrix H 



0<i<n-k-l,0<j< 



n — 1, where the elements Hq, . . . , hn^i e Fgm are linearly 
independent over Wg. It can be shown that the minimum rank 
distance of a Gabidulin code is d — n — k + 1, so the code 
satisfies the Singleton bound for the rank metric [1]. 

C. Linearized Polynomials 

A linearized polynomial or q-polynomial over F^m [8] is 
a polynomial of the form f{x) = X]"=o/i^'''' where fi £ 
Fgm. If /„ ^ 0, we call n the q-degree of f{x). It is easy 
to see that evaluation of a linearized polynomial is an F^- 
linear transformation from F^m to itself. In particular, the set 
of roots in Fgm of a linearized polynomial is the kernel of the 
associated map (and therefore a subspace of F^™). 

It is well-known that the set of linearized polynomials over 
Fgm forms an Fg-algebra under addition and composition 
(evaluation). The latter operation is usually called symbolic 
multiplication in this context and denoted by f{x) ® g{x) — 
f{g{x)). Note that if n and k are the g-degrees of f{x) and 
g{x), respectively, then the q-degree of f{x) g{x) is equal 
to n + fc. 

Let S C ¥g.^. The g-polynomial Ms{x) ^ ELo^^^^;!*! 
with Mq = 1 and least q-degree t whose root space contains 
S is unique and is called the minimal q-polynomial of S. The 
q-degree of Ms{x) is precisely equal to the dimension of the 
space spanned by S, and is also equal to the nullity of Ms (x) 
as a linear map. 



TABLE I 

Complexity of Operations in F^m (upper bound) 



D. Normal Bases 
If a basis A for 



is of the form A 



Q,[m-i]|^ then A is called a normal basis and 
a is called a normal element [8]. Assume that A is fixed. Let 
[a] denote the column vector [a^ ■ • • . Then 

any element a £ F^™ can be written as a = a |q;| . 

For a vector a = [ao, . . . , am-i] £ Fj^"\ let a*"' denote 
a cyclic shift to the left by i positions, that is, a^* — 
[ui, . . . , a,„_i, ao, . . . , ai_i] . Similarly, let a"^* = a^™~\ In 
this notation, we have a^'l = |q;], or a_W a^*. That is, 
q-exponentiation in a normal basis is simply a cyclic shift. 

Multiplications in normal bases are usually performed in 
the following way. Let T = [Tij] £ F^^™ be a matrix such 

that aofW = ^2^=0^"^^^^^^' * ~ 0, ...,to — 1. The matrix 
T is called the multiplication table of the normal basis. The 
number of nonzero entries in T is denoted by C(T) and 
is called the complexity of the normal basis [9]. Note that 
a |a] — r[[a|. It can be shown that, if a.b £ F^m, then 

Thus, a general multiplication in a normal basis requires 
mC{T) +m? multiplications and raC{T) ~ 1 additions in F^. 
Clearly, this is only efficient if T is sparse; otherwise, it is 
more advantageous to convert back and forth to a polynomial 
basis to perform multiplication. 

It is a well-known result that the complexity of a normal 
basis is lower bounded by 2m — 1. Bases that achieve this 
complexity are called optimal. More generally, low-complexity 
(but not necessarily optimal) normal bases can be constructed 
using Gauss periods, as described in detail in [9]. For q = 



Operations in F,™ 


Number of operations in Fq 


Multiplications 


Additions 


Inversions 


Multiplication 

Addition 

Inversion 


m'' 

^m? + 0{m) 


m(C(T) - 1) 
m 

+ 0{m) 


m + 2 



2^, such a construction is possible if and only if m satisfies 
gcd(m, s) = 1 and 8 | m [10]. As an example, for q = 
256, this condition is satisfied for any odd to. Among the odd 
TO < 100, the normal bases that result are in fact optimal when 
TO = 3, 5, 9, 11, 23, 29, 33, 35, 39, 41, 51, 53, 65, 69, 81, 
83, 89, 95, 99. For q = 2" and odd m, all of the normal bases 
constructed by Gauss periods are self-dual [10]. 

An interesting fact about a normal basis constructed via 
Gauss periods is that its multiplication table T lies entirely 
in the prime field Fp, where p is the characteristic of q. 
This in turn implies that the minimal polynomial of a is in 
¥p[x\ and the conversion matrices from/to the standard basis 
{a°,ai,. ..,a"-i} are also in F;J"^". 

In this paper, we are mostly interested in the case p — 2. 
In this case, multiplication by T can be done simply by 
using XORs. In Table U we give the complexity of each 
operation in F^™ assuming that p ^ 2. We also assume that 
q-exponentiations are free. Inversion is performed using the 
extended Euclidean algorithm on a standard basis. Details of 
these calculations can be found in [11]. 

III. Fast Decoding of Gabidulin Codes 
In this section, we assume a fixed basis A for W^m over F^. 

A. Standard Decoding Algorithm 

We review below the standard decoding algorithm for 
Gabidulin codes. This is the fastest decoding algorithm to date, 
except for low rates (see [6]). For details we refer the reader 
to [1], [3], [4], [6] and references therein. 

Let C C F"„ be a Gabidulin code with d^{C) = d defined 



by the parity-check matrix H 



Let c £ C be the 



transmitted word, let e £ F^™ be ah error word of rank r < 
{d—l)/2, and let r ~ c+e be the received word. The decoding 
problem is to find the unique e such that r — e £ C 
Since rank e = r, we can rewrite e as 



e = LV = [Li 



Lr] 



'Vl 



Vr 



(2) 



where Li,...,Lr £ F^ are called the error locations and 
Vl, . . . ,Vt £ ¥qm are called the error values. (Note that this 
expansion is not unique.) Define the error locators Xj = Ljh, 

where h ~ [/iq, . . . , /i„_i] £ F^™. Define also the syn- 
dromes Si — X)"=o^ '^f'^i; ^ — 0,...,d — 2. The error 
locators and error values must satisfy the syndrome equation 



St 



0, , 



,d~2 



(3) 



or, equivalently, 



5"^ A g[e-d+2\ ^ y[l-d+2]-^ 



3 



= 0,...,d-2. (4) 



The solution of the syndrome equation can be facihtated 
by the use of linearized polynomials. Due to the similar- 
ity between error locators and error values, there are two 
equivalent approaches to the problem. Define the the error 
span polynomial (ESP) r(x) as the minimal g-polynomial of 
Vi, . . . ,Vr and the error locator polynomial (ELP) A(.t) as 
the minimal g-polynomial of Xi, . . . , X-r- Then, either of the 
following key equations may be used: 



i=0 
i=0 



0, £-- 



0, £-- 



,d-2 



,d-2. 



(5) 



(6) 



These key equations can be solved, for instance, with the 
modified Berlekamp-Massey (BM) algorithm [4]. 

Assume the ESP is used. To find a basis Vi, . . . ,Vr for 
the root space of r(x), we can first compute the matrix 

r 1 ^ 

7 = [r(2;)J_^ representing r(a:) as a linear map, and then use 
Gaussian elimination to find a basis for the left null space of 7. 
To find the error locators, we can use Gabidulin's algorithm, 
which is an algorithm to solve a system of the form ([3]). 

Alternatively, if the ELP is used, we can use exactly the 
same procedure to find a basis Xi, . . . , Xr for the root space 
of A(x), followed by Gabidulin's algorithm to solve ^ and 
find the error values. 

After Xi , . . . , Xr and Vi, . . . ,Vr are found, the error lo- 
cations can be computed by LJ = Xj{hy, where (ft,)^ is a 
right-inverse of h. Note that (hY can be precomputed. Finally, 
the error word is computed from (|2]l. 

A summary of the algorithm and breakdown of complexity 
is given below. The algorithm consists of six steps: 

1) Compute the syndromes: [d — l)n multiplications and 
(d — \)[n — 1) additions in F^m . 

2) Compute the ESP/ELP: [d — l){d — 2) multiplications, 
i(c?— 2) additions and ^{d—1) inversions in F^™. 

3) Find a basis for the root space of the ESP/ELP: 

a) Compute the matrix of the linear map: rm multi- 
plications and additions in Fg™; 

b) Compute the left null space of this matrix: ^{m — 
T){m + T — l)m multiplications and ^{m — T){m + 
T — 1)(to — 1) additions in F^. 

4) Find the error locators/error values: + — 1 multi- 
plications, |t(t — 1) additions and r inversions in F^™. 

5) Compute the error locations: rnm multiplications and 
Tn{m — 1) additions in ¥q. 

6) Compute the error word: rnm multiplications and (t — 
l)nm additions in F^. 

Except for Step 3, the details of these calculations can be 
found in [6]. It can be seen that the complexity is dominated 
by steps [Tl and [3al each requiring 0{dw?) operations in Fg. 



B. Fast Decoding Using Low-Complexity Normal Bases 

We now assume that A — {a^'l} is a low-complexity 
normal basis with multiplication table T, and that Fg has 
characteristic 2. The essence of our approach lies in the 
following expression: 



Vi = 0, . . . , m — 1. 



In other words, multiplying an element of Fgm by a q- 
power of a costs only C(T) — m additions in Fg (recall that 
T lies in F2), rather than 0{m?) operations in Fg as in a 
general multiplication. Below, we exploit this fact in order 
to significantly reduce the complexity of decoding Gabidulin 
codes. 



Consider, as before, a Gabidulin code C C 



with 
. Let 



d^{C) — d defined by the parity-check matrix H = 

H' = [al'+^l], 0<i< d-2, 0<j< n'-l. ThenH = H'A 
for some A G F^* ^" and some n' satisfying n < n' < m. 
Thus, the map pven by c' = Ac is an injection from C to C, 
where C £ F^™ is the GabiduUn code defined by H'. Note 
that dR{C') = d. Thus, a received word r can be decoded 
by first applying a decoder for C' on r' = Ar, yielding a 
codeword c' = Ac, and then computing c — A'^c', where 
is a left inverse to A. The decoding complexity is equal to 
2n'nm additions and multiplications in Fg plus the complexity 
of decoding C . Thus, we will assume in the following that 
hi = a[*l, z = 0, . . . , n — 1. (Note that there is apparently no 
good reason for choosing a different H.) 

Now, consider the syndrome computation in Step [T] We 
have 



Si 



n-l 

i=0 



0,. 



,d - 2. 



It follows that the syndromes can be computed with only {d — 

l)n(C(r)-m) + (<i-l)(n-l)m< (d-l)nC(T) additions 
in Fg (no multiplications). 
Consider the computation of 



J=0, 



1 



in Step [3al Similarly, this computation can be done simply 
with Tm{C{T) - m) + rm^ = TmC{T) additions in Fg. 

Thus, the steps that were once the most demanding ones 
are now among the easiest to perform. 

There are some additional savings. Note that h is now an 
identity matrix with m — n additional all-zero columns at the 
right; thus the cost of computing Lj from Xj in Step|5]reduces 
to zero. (In particular, if n = to, then Xj = Lj, i.e., Lj is 
precisely the vector representation of Xj with respect to the 
normal basis.) 

It follows that the decoding complexity is now dominated 
by Steps |2] and |4] (although the kernel computation in Step [3b] 
may become significant if d is very small). For n = m and 
d ~ 2r + 1, the overall complexity of the algorithm is approxi- 
mately ^r^TO^ + ^TO^ multiplications and ^-T^mC{T) + ^m^ 
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— • — Time-domain algorithm (multiplications) 

Time-domain algorithm (additions) 

— ^< — Transform-domain algorithm (multiplications) 
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Error correction capability (t) 

Fig. 1. Complexity of tlie time-domain and transfoim-domain decoding 
algoritlims, in operations per Fg -symbol, as a function of the en'or correction 
capability t. An optimal self-dual normal basis is assumed. Parameters: q = 
256, n = m = 51, and d = 2t + 1. 

additions in F^. An example is illustrated in Fig. [T] for varying 
rates. 

IV. Transform-Domain Methods 
A. Linear Maps over F^™ and the q-Transform 

In this section, unless otherwise mentioned, all polynomials 
are ^-polynomials over Vqm with g-degree smaller than m. If 
V G F^„, is a vector of length n < m over F^m , we will take v 
to have length m, i.e., v £ F^, and set u„ = • • • = Wm-i — 0- 

We adopt the following convenient notation: if f{x) = 

J2i=o /«^''' g-polynomial, then / = [/o ■ • • fm-i] is 
a vector over F^m, and vice-versa. Thus, f{x) and / are sim- 
ply equivalent representations for the sequence /o, . . . , /m-i- 
In addition, we adopt a cyclic indexing for any such a 
sequence: namely, we define fi = fi mod m for all i. 
With this notation, we can write the symbolic multiplication 
h{x) = f{x) ® g{x) as a cyclic "g-convolution," namely, 

= E"=o Viffl-i' ^ = 0,...,m-l. 

We define the full q-reverse of a g-polynomial f{x) as the 
g-polynomial f{x) = J2'i^o^ /i^;''', where = f% \fi. 

For the remainder of this subsection, A ~ {a^}, B ~ {/3i} 
and = {9i} are bases for F^m over F^, with dual bases 
A' = {a^}, B' = and 9' = {6'^}, respectively. Recall 
that dual bases satisfy the property that Tr{aia'j) is equal to 1 
if i = j and is equal to otherwise, where Tr(x) = X^fc^^ 
is the trace function [8]. 

Lenvna 1: M = [/(x)]^ ^ = [fix]]^',. 

Lemma 2: Suppose ^ is a normal basis. Let F G F^m 
be such that = [fix)f^. Then /, = F{a[), i = 

0, . . . , TO — 1. In particular, [/] ^ = [F(a;)] ^, . 

Definition 1: The q-transform of a vector / G F^ (or a 
q-polynomial /(a;)) with respect to a normal element a is 



the vector F G F^™ (or the g-polynomial F{x)) given by 
F, = /(al^l) = o' J = 0, . . . , m - 1. 

Theorem 3: The inverse g-transform of a vector F G F^ 
(or a g-polynomial F{x)) with respect to a is given by 
/, ^ = X;^To^ i = 0, . . . , m - 1. In other 

words, the inverse q-transform with respect to a is equal to 
the forward g-transform with respect to a'. 

B. Implications to the Decoding of Gabidulin Codes 

Recall the notations of Section IIII-AI Assume that A — 
{q;!*! } is a normal basis and that the Gabidulin code has parity- 
check matrix H — [al'^-'l]. 

As in the transform-domain decoding of Reed-Solomon 
codes, the equation r = c + e, or r{x) = c{x) + e{x), is 
translated to the transform domain as R{x) = C{x) + E{x), 
where R{x), C{x) and E{x) are the q-transforms with respect 
to a of r{x), c{x) and e(x), respectively. Now, the fact 
that Ci = c(q!M) = 0, e = 0, - 2, implies that 

Se = Ri ^ Ei, e ^ 0,. . . ,d-2. Note also that Si = Ei_d+2, 
£^0,...,d-2. 

Lemma 4: Let r(x), S{x) and E{x) be linearized polyno- 
mials with q-degrees at most t, d — 2 and to — 1, respectively, 
and suppose and E{x) agrees with S{x) in the first d ~ 1 
coefficients. Then r(x) E{x) mod x'™' — x agrees with 
r(x) (g) S{x) in the coefficients t < i < d ~ 2. 

Theorem 5 (The Key Equations): 

T{x) E{x) = (mod - x) 
A{x) (E) E{x) = (mod x^™] - x). 

In particular, (|5]l and (|6]l hold. 

Proof: For the first key equation, let 7 = [r(2;)]yi- Note 
that T{Vj) = impHes Vj j — 0, j — 1, . . . ,t. From (HI we 
have 

[r{x)^jE{x)]^, 

T 

= [E{x)] \, [r(x)] = e 7 - E 1^7 = 0. 

j=i 

The form (jSj of this key equation follows immediately after 
applying Lemma |4| 

The proof of the second key equation is similar and is 
omitted due to lack of space. ■ 

Besides allowing us to give conceptually simpler proofs 
of the key equations, the transform approach also provides 
us with the theoretical ground for proposing a new decoding 
algorithm for Gabidulin codes. The main idea is that, after the 
ESP or the ELP is found, the remaining coefficients of E{x) 
can be computed from 

r 

^£ = - ^ r,41^ = 0, ^ = d-i,...,TO-i 

i=l 

T 

^£ = -^A,^|'l, = 0, l,...,TO-d+L 

i=0 



Then, the error polynomial e{x) can be obtained through an 
inverse q-transform. 

Computing this inverse transform takes, in general, nm 
multiplications and additions in F^m (or km if the code is 
systematic and the parity portion is ignored). However, if A 
is a self-dual normal basis, then an inverse transform becomes 
a forward transform, and the same computational savings 
described in Section IIII-BI can be obtained here. Note that 
most normal bases constructed via Gauss periods over fields 
of characteristic 2 are indeed self-dual (see Section III-DI and, 
e.g., [10]). 

Below is a summary of the new algorithm, together with a 
breakdown of the complexity. 

1) Compute the syndromes: see Section flll-AI 

2) Compute the ESP/ELP: see Section HITaI 

3) Compute E{x) recursively: (771 — (i+l)T multiplications 
and (m — d + l)(r — 1) additions in F^m. 

4) Compute the error word: nmC{T) additions in F^ (or 
kmC{T) if the code is systematic). 

As it can be seen from Step [3] above, the new algorithm 
essentially replaces the 0{(P) operations of Gabidulin's algo- 
rithm with the 0{d{m~d)) operations required for recursively 
computing E{x). Thus, the algorithm is most beneficial for 
low -rate codes. For n ^ m and d = 2r + 1, the overall 
complexity of the algorithm is approximately {m + 2t)tw? 
multiplications and (m + 2T)TmC{T) additions in F,. It is 
straightforward to check that this complexity is smaller than 
that of [5] (see [6]). An example is illustrated in Fig. [T] 

V. Fast Encoding 

As for any linear block code, encoding of Gabidulin codes 
requires, in general, 0{kn) operations in F,™, or 0{k{n — k)) 
operations in F^™ if systematic encoding is used. 

We show below that, if the code has a high rate and 
Fqm admits a low-complexity normal basis, then the encod- 
ing complexity can be significantly reduced. Alternatively, if 
nonsystematic encoding is allowed and F^™ admits a self- 
dual low-complexity normal basis, then very fast encoding is 
possible. 

A. Systematic Encoding of High-Rate Codes 

Let Cn~k, ■ ■ ■ , Cn-i € Fgm denote the message coefficients. 
We set r.i — 0, i = 0, . . . ,n — k — 1 and r,; = c^, 
i — n ~ k, . . . ,n — 1, and perform erasure decoding on 
r = [ro ■■■ r„_i] to obtain cp . ,c„ _fc-i. 

We use the algorithm of Section IIII-AI with the compu- 
tational savings of Section IIII-BI Note that only steps 1, 4 
and 5 need to be performed, since the error locations (and 
thus also the error locators) are known: for j — 1, . . . ,d — 1, 
Lj is a column vector with a 1 in the jth position and 
zero in all others. Thus, the complexity is dominated by 
Gabidulin's algorithm, requiring 0{d^) operations in Fgm 
(see Section IIII-Ab . For high-rate codes, this improves on the 
previous value of 0{dk) mentioned above. Note that, without 
the approach in Section IIII-BI encoding by erasure decoding 
would cost 0{dn) operations in F^m. 



B. Nonsystematic Encoding 

Here we assume that n — m. Let F^-k, ■ ■ ■ , Fm^i denote 
the message coefficients, and let F{x) — X]JLm-fc -^i-^'"''- 
We encode by taking the (inverse) q-transform with respect 
to a, where A = {a'*'} is a self-dual normal basis. Then 
Ci ~ F(a[*l), i = 0, . . . ,m — 1. It is clear that this task takes 
only mkCiT) additions in F,, and is therefore extremely fast. 
The decoding task, however, has to be slightly updated. 

Since, by construction, every codeword satisfies c(a['l) = 
for i = 0, . . . ,d — 2, most part of the decoding can remain 
the same. If decoding is performed in the time domain, 
then one additional step is needed to obtain the message: 
namely, computing the forward g-transform Fj = c(a[^l), for 
j ~ m ~ k, . . . ,171 — 1. These extra mkC{T) additions in F^ 
barely affect the decoding complexity. On the other hand, if 
decoding is performed in the transform domain, than the last 
step (obtaining e{x) from E{x)) can be simply skipped, as 
F{x) = R{x) — E{x). This further saves at least mkC{T) 
additions in F^. 

VI. Conclusions 

In this paper, we have presented fast encoding and decoding 
algorithms for Gabidulin codes, both in time and in transform 
domain. The algorithms derive their speed from the use of an 
optimal (or low-complexity) normal basis, and the fact that 
multiplication by a q-power of a in such a normal basis can 
be performed very quickly. With respect to systematic high- 
rate codes (which seem to be the most suitable to practical 
applications), the decoding complexity is now dominated by 
the BM algorithm and Gabidulin's algorithm. An efficient im- 
plementation of these two algorithms is therefore an important 
practical question. 
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